new git integraton code

Modules/Helpdesk/Http/Controllers/GitWebhookController.php

@@ -64,16 +64,6 @@ final class GitWebhookController
         $deliveryId = $this->deliveryId($request, $provider);
         $rawPayload = $request->getContent();
 
-        if (! $this->hasValidGiteaAuthorization($request)) {
-            return response()->json([
-                'status' => 'rejected',
-                'message' => 'Gitea webhook authorization failed.',
-                'commit_count' => 0,
-                'linked_count' => 0,
-                'ignored_count' => 1,
-            ], 403);
-        }
-
         try {
             /** @var array<string, mixed> $payload */
             $payload = json_decode($rawPayload, true, 512, JSON_THROW_ON_ERROR);
@@ -99,9 +89,9 @@ final class GitWebhookController
             ], 404);
         }
 
-        if (! $this->hasValidSignature($request, $repository, $provider, $rawPayload)) {
+        if (! $this->hasValidGiteaSecurity($request, $repository, $provider, $rawPayload)) {
             $result = ['status' => 'rejected', 'message' => 'Git webhook signature or token validation failed.', 'commit_count' => 0, 'linked_count' => 0, 'ignored_count' => 1];
-            $service->logWebhook($repository, $provider, $deliveryId, $event, $result);
+            $service->logWebhook($repository, $provider, $deliveryId, $event, $result, $payload);
 
             return response()->json($result, 403);
         }
@@ -198,6 +188,19 @@ final class GitWebhookController
             || hash_equals('sha1=' . hash_hmac('sha1', $rawPayload, $secret), $signature);
     }
 
+    /**
+     * Validate Gitea webhook security without allowing an optional Authorization
+     * header mismatch to hide otherwise valid signed push deliveries.
+     */
+    private function hasValidGiteaSecurity(Request $request, GitRepository $repository, string $provider, string $rawPayload): bool
+    {
+        if ($this->hasValidSignature($request, $repository, $provider, $rawPayload)) {
+            return true;
+        }
+
+        return $this->hasValidGiteaAuthorization($request);
+    }
+
     /**
      * Validate the optional Authorization header configured for the local Gitea webhook.
      */